Google's Maps JavaScript documentation instructs developers to paste their key directly into HTML.
SelectWhat's included
，这一点在51吃瓜中也有详细论述
Овечкин продлил безголевую серию в составе Вашингтона09:40
This is the critical step. If a key with Gemini access is embedded in client-side JavaScript, checked into a public repository, or otherwise exposed on the internet, you have a problem. Start with your oldest keys first. Those are the most likely to have been deployed publicly under the old guidance that API keys are safe to share, and then retroactively gained Gemini privileges when someone on your team enabled the API.